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Abstract — This paper provides a comprehensive review of the 
domain of physical layer security for wireless communications. 
The essential premise of physical-layer security is to enable 
the exchange of confidential messages over a wireless medium 
in the presence of unauthorized eavesdroppers. This can be 
achieved primarily in two ways: without the need for a secret 
key by intelligently designing transmit coding strategies, or by 
exploiting the wireless communication medium to develop secret 
keys over public channels. We begin with an overview of the 
foundations dating back to the pioneering work of Shannon and 
Wyner on information-theoretic security. We then describe the 
evolution of secure transmission strategies from point-to-point 
channels to multiple-antenna systems, followed by generalizations 
to multiuser broadcast, multiple-access, interference, and relay 
networks. Subsequently, we evaluate secret-key establishment 
protocols based on physical layer mechanisms, along with an 
overview of practical secrecy-preserving code design. 



I. INTRODUCTION 

The two fundamental characteristics of the wireless 
medium, namely broadcast and superposition, present differ- 
ent challenges in ensuring reliable and/or secure communi- 
cations in the presence of adversarial users. The broadcast 
nature of wireless communications makes it difficult to shield 
transmitted signals from unintended recipients, while super- 
position can lead to the overlapping of multiple signals at the 
receiver. As a consequence, adversarial users are commonly 
modeled either as (1) an unauthorized receiver that tries to 
extract information from an ongoing transmission without 
being detected, or (2) a malicious transmitter (jammer) that 
tries to degrade the signal at the intended receiver [1|-|3|. 

While jamming and counter-jamming physical layer strate- 
gies have been of long-standing interest especially in military 
networks, the security of data transmission has tradition- 
ally been entrusted to key-based enciphering (cryptographic) 
techniques at the network layer J4j. However, in dynamic 
wireless networks this raises issues such as key distribution 
for symmetric cryptosystems, and high computational com- 
plexity of asymmetric cryptosystems. More importantly, all 
cryptographic measures are based on the premise that it is 
computationally infeasible for them to be deciphered without 
knowledge of the secret key, which remains mathematically 
unproven. The information-theoretic aspects of secrecy at the 
physical layer have experienced a resurgence of interest only 
in the past decade or so. Therefore, the remainder of this paper 
is devoted to surveying and reviewing the various aspects of 
physical-layer security in modern wireless networks. 
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The fundamental principle behind physical-layer security is 
to limit the amount of information that can be extracted at 
the 'bit' level by an unauthorized receiver. With appropriately 
designed coding and transmit precoding schemes in addition 
to the exploitation of any available channel state information, 
physical-layer security schemes enable secret communication 
over a wireless medium without the aid of an encryption key. 
However, if it is desirable to use a secret key for encryption, 
then information-theoretic security also describes techniques 
that allow for the evolution of such a key over wireless chan- 
nels that are observable by the adversary. Alternatively, since 
they can operate essentially independently of the higher layers, 
physical layer techniques can be used to augment already 
existing security measures. The vast majority of information- 
theoretic security research reviewed in this survey contains the 
premise that the eavesdropper is passive, i.e., does not transmit 
in order to conceal its presence. 

The survey does not proceed in a strictly chronological 
order, nor is the list of references intended to be exhaustive. 
Furthermore, due to inaccessibility we are forced to omit 
contributions to the field published within the former Soviet 
Union [5| and other international forums. Instead, we aim to 
provide a high-level overview of the historical development of 
the field with references that are easily accessible, juxtaposed 
with recent and ongoing research efforts. 

The remainder of the paper is organized as follows. In 
the next section, the fundamental mathematical precepts of 
secrecy are presented, along with a description of the most 
elementary secrecy problem: the wiretap channel. The state- 
of-the-art in the burgeoning area of multi-antenna wiretap 
channels is described in Section [Til] The extension to more 
than three terminals for broadcast, multiple-access, and inter- 
ference channels is described in Section [TV] The development 
of secrecy in relay channels and miscellaneous systems such 
as sensor and cognitive radio networks is carried out in[V] The 
important issue of secret-key agreement in wireless networks 
is studied in Section [VI] Section fVU\ highlights the emerging 
areas of practical wiretap code design and cross-disciplinary 
approaches to secrecy. Finally, in Section I Villi we summarize 
our discussion. 

II. Fundamentals 

The simplest network where problems of secrecy and confi- 
dentiality arise is a three-terminal system comprising a trans- 
mitter, the intended (legitimate) receiver, and an unauthorized 
receiver, wherein the transmitter wishes to communicate a 
private message to the receiver. In the sequel, the unauthorized 
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receiver is referred to interchangeably as an eavesdropper or 
wiretapper. Encryption of messages via a secret key known 
only to the transmitter and intended receiver has been the 
traditional route to ensuring confidentiality. Up until the 20th 
century, the design of cryptographic methods was based on the 
notion of computational security, without a solid mathematical 
basis for secrecy. A classical example was Vernam's one- 
time pad cipher (6), where the binary message or plaintext 
is XOR'ed with a random binary key of the same length. 

A. Performance Metrics 

Shannon postulated the information-theoretic foundations of 
modern cryptography in his ground-breaking treatise of 1949 
0. Shannon's model assumed that a non-reusable private key 
K is used to encrypt the confidential message M to generate 
the cryptogram C, which is then transmitted over a noise- 
less channel. The eavesdropper has unbounded computational 
power, has knowledge of the transmit coding scheme, and 
has access to an identical copy of the signal at the intended 
receiver. The notion of perfect secrecy was introduced, which 
requires that the a posteriori probability of the secret message 
computed by the eavesdropper based on her received signal 
be equal to the a priori probability of the message. In other 
words, 

7(M;C)=0, (1) 

where /(•; ■) denotes mutual information. A by-product of this 
analysis was that perfect secrecy [8| can be guaranteed only 
if the secret key has at least as much entropy as the message 
to be encrypted, H(K) > H(M), which validated Vernam's 
one-time pad cipher system. 
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Fig. 1. The degraded wiretap channel |9|. 

Wyner ushered in a new era in information-theoretic se- 
curity when he introduced the wiretap channel in J9J, which 
considered the imperfections introduced by the channel. In the 
wiretap channel, the information signal X is transmitted to the 
intended receiver over the 'main channel' which is modeled 
as a discrete memoryless channel. The receiver observes Y, 
which subsequently passes through an additional 'wiretap 
channel' before being received by the eavesdropper as Z, 
as shown in Fig. 1. Under the assumption that the source- 
wiretapper channel is a probabilistically degraded version of 
the main channel [10|, Wyner sought to maximize the trans- 
mission rate R in the main channel while making negligible 
the amount of information leaked to the wiretapper channel. 

In his development Wyner defined the equivocation rate of 
the wiretapper, where the wiretapper equivocation or 'ambi- 
guity' is the conditional entropy H(S k | Z n ), and therefore 
the equivocation rate is 

R < H(S k 



If the equivocation rate R e is arbitrarily close to the informa- 
tion rate R, then R is the secrecy capacit$\ of the wiretap 
channel. He constructed a randomized coding scheme which 
sought to hide the information stream in the additional noise 
impairing the wiretapper by mapping each message to many 
codewords according to an appropriate probability distribution. 
This way, one induces maximal equivocation at the wiretapper, 
and Wyner was able to show that secure communication was 
possible without the use of a secret key. 

In 1993, Maurer lfl4ll presented a strategy that allowed a 
positive rate even when the wiretapper observes a "better" 
channel than the one used by the legitimate users. The essence 
of Maurer's scheme is the joint development of a secret key 
by the transmitter and receiver via communication over a 
public (insecure) and error-free feedback channel. Thereafter, 
research in information-theoretic secrecy developed along two 
main branches: secret key-based secrecy as in the work by 
Shannon and Maurer, and keyless security as in the work by 
Wyner. In Sections III-V we trace the evolution of keyless 
security over the past decade. We revisit the topic of key-based 
security for wireless channels in Section IVII 

B. Single-Antenna Wiretap Channels Since Wyner 

Carleial and Hellman iflOl considered a special case of 
Wyner's model where the main channel is noiseless and the 
wiretap channel is a binary symmetric channel, and analyzed 
the applicability of systematic linear codes for preserving the 
secrecy of an arbitrarily portion of the transmitted message. 
For the degraded wiretap channel with additive Gaussian noise 
[12 1, the essential result for the secrecy capacity Cs was the 
following: 

Cs — Cm — Cw, (2) 

where Cm and Cw are the Shannon capacities of the main and 
wiretap channels, respectively. Ultimately, it was established 
that a non-zero secrecy capacity can only be obtained if the 
eavesdropper's channel is of lower quality than that of the 
intended recipient. 

Csizar and Korner considered a more general (non- 
degraded) version of Wyner's wiretap channel in ifTTI . where 
they obtained a single-letter characterization of the achievable 
(private message rate, equivocation rate, common message 
rate)-triple for a two-receiver broadcast channel. For the spe- 
cial case of no common messages, the secrecy capacity was 
defined as 



C s 



max / (V: Y) 

V^fX^YZ 



I(V;Z), 



(3) 



which is achieved by maximizing over all joint probability 
distributions such that a Markov chain V, X, YZ is formed, 
where V is an auxiliary input variable. 

In iTHl . Ozarow and Wyner studied the type-II wiretap 
channel, where the main communication channel is noiseless 
but the wiretapper has access to an arbitrary subset [i of the 

'Strictly speaking, Wyner's definition of "perfect secrecy" as the scenario 
in which the block-length-normalized mutual information at the eavesdropper 
vanishes in the limit of long block lengths was weaker than the one proposed 
by Shannon [cf. {T}], which requires that the mutual information be zero 
regardless of the block length. 
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N coded bits, and optimal tradeoffs between code rate k/N 
and fi that guaranteed secrecy were characterized. 

The consideration of channel fading in wiretap channels 
has recently opened new avenues of research. Barros and 
Rodrigues et al 1 16|-[ 17] analyzed the outage secrecy capacity 
of slow fading channels and have showed that in the presence 
of fading information-theoretic security is achievable even 
when the eavesdropper has a better average SNR than the 
legitimate receiver. 

Li et al. [18] examined an achievable secrecy rate for 
an AWGN main channel, while the eavesdropper's channel 
is Rayleigh fading with additive Gaussian noise, and its 
realizations are unknown to Alice and Bob. The main result 
of this paper is that with Gaussian random codes, artificial 
noise injection and power bursting, positive secrecy rate is 
achievable even when the main channel is arbitrarily worse 
than the eavesdropper's average channel. 

Relatively fewer studies consider the case of a complete 
absence of eavesdropper CSI at the transmitter in fading 
wiretap channels. In [19], the authors consider a block-fading 
scalar wiretap channel where the number of channel uses 
within each coherence interval is large enough to invoke 
random coding arguments. This assumption is critical for their 
achievable coding scheme which attempts to "hide" the secure 
message across different fading states. A recent approach 
towards understanding the information-theoretic limits of wire- 
tap channels with no eavesdropper CSI has been taken by 
studying the compound wiretap channel l20l . The compound 
wiretap channel captures the situation in which there is no or 
incomplete CSI at the transmitter by characterizing the eaves- 
droppers channel with a finite set of states, and guarantees 
secure communication under any state that may occur. The 
schemes designed for the compound channel are robust to 
various communication environments. 

III. MULTI- ANTENNA CHANNELS 

The explosion of interest in multiple-input multiple-output 
(MIMO) systems soon led to the realization that exploiting the 
available spatial dimensions could also enhance the secrecy 
capabilities of wireless channels. The work by Hero [21] 
is arguably the first to consider secret communication in a 
MIMO setting, and sparked a concerted effort to apply and 
extend the single-antenna wiretap theory to this new problem. 
In a fading MIMO channel where the transmitter, receiver, 
and eavesdropper are equipped with Nt, Nr, Ne antennas 
respectively, a general representation for the signal received 
by the legitimate receiver is 



Yb 



H,,x 



n 6 , 



while the received signal at the eavesdropper is 
y e = H e x Q + n e , 



(4) 



(5) 



where x a E (£N T xi j s ^ transmit signal with covariance 
£{x a xf } = Q^TrtCL) ^ P, H ha e C^ x ^,H 6a G 
C eXJVt are the MIMO complex Gaussian channel matrices, 
and rib,n e are the respective zero-mean complex Gaussian 
additive noise vectors. 
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Fig. 2. General MIMO wiretap channel. 



Hero examined the utility of space-time block coding for 
covert communications in Kill , and designed CSTinformed 
transmission strategies to achieve either a low probability of 
intercept (equivalent to secrecy rate), or a low probability of 
detection for various assumptions about the CSI available to 
the eavesdropper. One of the main results was that if the 
eavesdropper is completely unaware of its receive CSI, then 
a secrecy capacity-achieving (i.e., equivocation-maximizing) 
strategy is to employ a space-time constellation with a constant 
spatial inner product. 

Parada and Blahut analyzed a degraded single-input 
multiple-output (Nt = 1,Nr,Ne > 1) wiretap channel in 
[22], and obtained a single-letter characterization of its secrecy 
capacity via transformation into a scalar Gaussian wiretap 
channel, and then re-applying (0. The authors also proposed 
a secrecy rate outage metric for the SIMO wiretap channel 
with slow fading, and observed a secrecy diversity gain of 
order proportional to the number of receiver antennas. The 
corresponding MISO case was studied in ll23ll . l24l . who noted 
that the MIMO wiretap channel is not degraded in general. 
Since this renders a direct computation of OJ difficult, they 
therefore restricted attention to Gaussian input signals. For the 
special case of Nt = 2, Nr = 2, Ne = 1 analyzed by Shafiee 
and coworkers in ll25ll . a beamforming transmission strategy 
was shown to be optimal. 

The next steps toward understanding the full-fledged MIMO 
wiretap channel were taken in [26|-[29|, which considered 
the case of multiple antennas at all nodes and termed 
it the MIMOME (multiple-input multiple-output multiple- 
eavesdropper) channel. Khisti et al. [26] developed a genie- 
aided upper bound for the MIMO secrecy capacity for which 
Gaussian inputs are optimal. When the eavesdropper's in- 
stantaneous channel state is known at the transmitter, it was 
shown that an asymptotically optimal (high SNR) scheme is to 
apply a transmit precoder based upon the generalized singular 
value decomposition (GSVD) of the pencil (Hb,H e ), which 
decomposes the system into parallel channels and leads to a 
closed-form secrecy rate expression. For the so-called MIS- 
OME special case where Nr = 1,Nt,Ne > 1, the optimal 
transmit beamformer is obtained as the generalized eigenvector 
i/> m corresponding to the largest generalized eigenvector A m 
of 

hf h b tp. m = A TO Hf H e i>m- 
If only the statistics of H e are known to the transmitter, then 
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the authors proposed an artificial noise injection strategy as 
first suggested by Goel and Negi [28], [29 1. The artificial noise 
is transmitted in conjunction with the information signal, and 
is designed to be orthogonal to the intended receiver, such that 
only the eavesdropper suffers a degradation in channel quality 
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Fig. 3. The MFMO secrecy rates of GSVD-beamforming (34), (40), artificial 
noise [29], and waterfilling over the main channel, Nt = Ne = 3, Nr = 2. 

An example of the secrecy rate performance of various 
transmission strategies for the MIMO wiretap channel is 
shown in Fig. [3] The GSVD schemes require instantaneous 
knowledge of eavesdropper channel H e , the artificial noise 
scheme requires the statistics of H e , and if no information is 
available regarding H e , then the relatively poor performance 
of waterfilling on the main channel is also shown. 

The MIMO wiretap channel was studied independently by 
Oggier and Hassibi [27], who computed a similar upper bound 
on the MIMO secrecy capacity, and showed after a matrix 
optimization analysis that 

C s = max logdet (I + H b Q K Hf ) -logdet (I + HeQ^Hf ) . 

(6) 

In QUI . Liu and Shamai reexamined the MIMO wiretap 
channel with a more general matrix input power-covariance 
constraint Q x X S, and showed that the conjecture of a 
Gaussian input U = X without prefix coding is indeed an 
optimal secrecy capacity-achieving choice. 

Zhang et al. attempted to bypass the non-convex opti- 
mization of the optimal input covariance matrix by drawing 
connections to a sequence of convex cognitive radio trans- 
mission problems, and obtained upper and lower bounds on 
the MIMO secrecy capacity. Li and Petropulu [32] computed 
the optimal input covariance matrix for a MISO wiretap 
channel, and presented a set of equations characterizing the 
general MIMO solution. Bustin and coauthors [33] exploited 
the fundamental relationship between mean-squared error and 
mutual information to provide a closed-form expression for 
the optimal input covariance Q x that achieves the MIMO 
wiretap channel secrecy capacity, again under an input power- 
covariance constraint. 



More precisely, it was shown in (3311 that, under the matrix 
power constraint Q x < S, the solution of (6) is given by 

A 

C sec (S) = ^log ai (7) 

i=l 

where on, i = 1, . . .A, are the generalized eigenvalues of the 
pencil 

(S3HfH fc S3 +1, S^HfH e S5+I) (8) 

that are greater than 1 . 

Note that, since both elements of the pencil (O are strictly 
positive definite, all the generalized eigenvalues of the pencil 
© have real positive values EQ, lfl37l . In ©, a total of A 
of them are assumed to be greater than 1. Clearly, if there 
are no such eigenvalues, then the information signal received 
at the intended receiver is a degraded version of that of the 
eavesdropper and in this case, the secrecy capacity is zero. 

It should be noted that, under the average power constraint 
Tr(Qj;) ^ P, there is not a computable secrecy capacity 
expression for the general MIMO case. In fact, for the average 
power constraint, the secrecy capacity is found through an 
exhaustive search over the set {S : S y 0,Tr(S) < P}. More 
precisely, we have 1511 . (48l Lemma 1] 

C sec (P)= max C sec (S) (9) 

S^0,Tr(S)<P 

where, for any given semidefinite S, C sec (S) can be computed 
as given by (0. 

Subsequently, numerous research contributions emerged 
that considered a number of practical issues regarding the 
MISO/MIMO wiretap channel, of which we enumerate a few 
below: 

• Optimal power allocation methods for the artificial noise 
strategy were presented in 11391 . and for the GSVD-based 
precoding scheme in [40 1 . 

• If even statistical information regarding the eavesdrop- 
per's channel is unavailable, then Swindlehurst et al. [33, 
1 38 1 suggested an approach where just enough power is 
allocated to meet a target performance criterion (SNR or 
rate) at the receiver, and any remaining power is used for 
broadcasting artificial noise, since the secrecy rate cannot 
be computed at the transmitter. A compound wiretap 
channel approach and a resultant universal coding scheme 
that guarantees a positive secrecy rate is presented in (43J. 

• The effects of imperfect and quantized main channel state 
information at the transmitter upon the secrecy rate were 
examined in BTIl and l42l . respectively. 

• MIMO secrecy capacity has also been studied for 
frequency-selective [44 1 and ergodic [45| channel fading 
processes. 

A summary of transmission strategies in the MIMO wiretap 
channel for various assumptions regarding eavesdropper chan- 
nel state information at the transmitter (ECSIT) is presented 
in Table U 
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IV. Broadcast, Multiple- Access, and Interference 
Channels 

The concept of information-theoretic security is easily 
extended to larger multi-user networks with more than 2 
receivers and/or transmitters. The original wiretap channel 
as proposed by Wyner [9|, is a form of broadcast channel 
(BC) where the source sends confidential messages to the 
destination while the messages should be kept as secret as 
possible from the other receiver(s)/ eavesdropper(s). Csiszar 
and Korner, extended this work to the case where the source 
sends common information to both the destination and the 
eavesdropper, and confidential messages are sent only to the 
destination ifTTl . The secrecy capacity region of this scenario, 
for the case of a BC with parallel independent subchannels is 
considered in [46 1 and the optimal source power allocation that 
achieve the boundary of the secrecy capacity region is derived. 
The secrecy capacity region of the MIMO Gaussian broadcast 
channel with common and confidential messages, is character- 
ized in l47l using a channel enhancement approach [48] and 
under matrix input power-covariance constraint Qa; ^ S. The 
notion of an enhanced broadcast channel was firstly introduced 
in J48 1 and was used jointly with entropy power inequality to 
characterize the capacity region of the conventional Gaussian 
MIMO broadcast channel (without secrecy constraint). But, 
as we will show, most of the current works in the literature, 
studying different examples of MIMO broadcast channel with 
secrecy, use this notion. Moreover, instead of the average total 
power constraint Tr (Q x ) ^5 P, they consider the more general 
matrix input power-covariance constraint Q x ^ S. 

The discrete memoryless broadcast channel with two confi- 
dential messages sent to two receivers, where each receiver 
acts as an eavesdropper for the other one, was studied in 
[49 1, where inner and outer bounds for the secrecy capacity 
region were established. This problem was studied in [50| 
for the multiple-input single-output (MISO) Gaussian case 
and in llSTl for general MIMO Gaussian case. Rather sur- 
prisingly, it was shown in IBTl that, under the matrix input 
power-covariance constraint, both confidential messages can 
be simultaneously communicated at their respected maximum 
secrecy rates, where the achievability is obtained using the 
dirty-paper coding. To prove this result, Liu et al. revisited 
the MIMO Gaussian wiretap channel and showed that a coding 
scheme that uses artificial noise and random binning achieves 
the secrecy capacity of the MIMO Gaussian wiretap channel 
as well ED. 

Consider the broadcast channel represented by (3) and 
(4), but this time the transmitter has independent confidential 
messages W\ (intended for receiver 1 but needing to be kept 

TABLE I 

Comparison of MIMO wiretap transmission strategies for 

VARIOUS ECSIT ASSUMPTIONS 



Parameters 


Strategy 


MIMOME, no ECSIT 
MIMOME, statistical ECSIT 
MISOME, complete ECSIT 
MIMOME, complete ECSIT 


Artificial noise 
Artificial noise 
GEVD beamforming 
GSVD precoding 



secret from receiver 2) and W2 (intended for receiver 2 but 
needing to be kept secret from receiver 1). From [51 , Corollary 
2], under the matrix constraint S, the secrecy capacity region 
is given by the set of nonnegative rate pairs (i?i,i?2) such 
that 

A 

i?i<^loga 8 (10) 

i=l 

where on, i = 1, . . .A, are the generalized eigenvalues of the 
pencil (0 that are bigger than 1, and /3j j = 1, . . .(Nt — A) 
are the generalized eigenvalues of the pencil ([8]) that are less 
than or equal to 1. 

The secrecy capacity region of the MIMO Gaussian broad- 
cast channels with confidential and common messages, where 
the transmitter has two independent confidential messages and 
a common message, is characterized in [52 1 . The achievability 
is obtained using secret dirty-paper coding, while the converse 
is proved by using the notion of channel splitting 11521 . 

Secure broadcasting with more than two receivers are con- 
sidered in 1521,|l54l, 1221, and J2S] (and reference therein). 
More precisely, there is one transmitter which wants to com- 
municate with several legitimate users in the presence of an 
external eavesdropper. The secrecy capacity region for the two- 
legitimate receiver case is characterized by Khandani et al. 
041 using the enhanced channels, and for an arbitrary number 
of legitimate receivers by Ekrem et. al [55]. Ekrem et. al. 
use the relationships between the minimum-mean-square-error 
and the mutual information, and equivalently, the relationships 
between the Fisher information and the differential entropy to 
provide the converse proof. 

In l56l . Liu et al. considered the secrecy capacity regions 
of the degraded vector Gaussian MIMO broadcast channel 
with layered confidential messages. They presented a vector 
generalization of Costa's Entropy Power Inequality to provide 
their converse proof. The role of artificial noise for jamming 
unintended receivers in multiuser downlink channels was 
investigated in El, l58l . 

Other recent works on secure multi user communications 
investigated the multiple-access channel (MAC) with confiden- 
tial messages 1251, Ejl, the MAC wiretap channel (MAC-WT) 
[61 1, [62 1, and the cognitive MAC with confidential messages 
[ 63 1 . In l59l and l60l . two transmitters communicating with a 
common receiver try to keep their messages secret from each 
other. For this scenario, the achievable secrecy rate region, and 
the capacity region for some special cases, are considered. 

In loTl . the Gaussian multiple access wire-tap channel 
(GMAC-WT) is considered where multiple users are transmit- 
ting to a base station in the presence an eavesdropper which 
receives a noisy version of the signal received at the base 
station (degraded wiretapper). In floTll . achievable rate regions 
were found for different secrecy constraints, and it was shown 
that the secrecy sum capacity can be achieved using Gaussian 
inputs and stochastic encoders, where the secrecy sum capacity 
is given by: In l62l . a general, not necessarily degraded, 
Gaussian MAC-WT is considered, and the optimal transmit 
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power allocation that achieves the maximum secrecy sum-rate 
is obtained. It is shown in [62] that, a user that is prevented 
from transmitting based on the obtained power allocation can 
help increase the secrecy rate for other users by transmitting 
artificial noise to the eavesdropper. 

In ll63l , Liu et al. consider the fading cognitive multiple- 
access channel with confidential messages (CMAC-CM), 
where two users attempt to transmit common information to 
a destination while user 1 also has confidential information 
intended for the destination and tries to keep its confidential 
messages as secret as possible from user 2. The secrecy 
capacity region of the parallel CMAC-CM is established and 
the closed-form power allocation that achieves every boundary 
point of the secrecy capacity region is derived [63 1. It should 
be noted that, all the above works in the field of MAC with 
confidential messages, assume single antenna nodes. 

The interference channel (IFC) refers to the case where 
multiple communication links are simultaneously active in the 
same time and frequency slot, and hence potentially interfere 
with each other. A special application of the IFC with secrecy 
constraints is addressed in ||64l , where the message from only 
one of the transmitters is considered confidential. The more 
general case, where each receiver acts as an eavesdropper for 
the other transmitter, was studied in ||49l where, in the absence 
of a common message, the authors imposed a perfect secrecy 
constraint and obtained inner and outer bounds for the perfect 
secrecy capacity region. 

For multiuser networks, a useful metric that captures the 
scaling behavior of sum secrecy rate as the transmit SNR, 
p, goes to infinity is the degrees of freedom (DoF), which can 
be defined as 

(p) 



v 



p^oc log (p) 



The number of secure DoF for K-user Gaussian IFCs (K > 3) 
has been addressed in 1651 . (66), l67l . and it was shown 
that under very strong interference, positive secure DoFs are 
achievable for each user in the network. More precisely, for 
the case of K-usei SISO Gaussian interference channel with 
confidential messages, where each node has 1 antenna and 
each transmitter needs to ensure the confidentiality of its 
message from all non-intended receivers, a secure DoF of 



V = 



K-2 
2K-2 



(12) 



is almost surely achievable for each user 11661 . The achievablity 
is obtained by interference alignment and channel extension 
[68 1. Moreover, for the case of K-nsei SISO Gaussian inter- 
ference channel with an external eavesdropper, each user can 
achieve 

K-2 

(13) 



V 



2K 



secure DoF in the ergodic setting. 

It should be noted that all of the above references 
ll67l assume single antenna nodes. In fact, to the best of our 
knowledge, the only works considering the effect of multi- 
antenna nodes on secrecy in interference channel are |69I- ||7T1 . 
In |69l , Jorswieck et al. study the achievable secrecy rates of 
a two-user MISO interference channel, where each receiver 



has single antenna. They model a non-cooperative game in 
MISO interference channel and obtain the Nash equilibrium 
point using an iterative algorithm. 

In ||70l and (7T|, Swindlehurst et al. investigate the two- 
user MIMO Gaussian interference channel with confidential 
messages, where each node has arbitrary number of antennas. 
Several cooperative and non-cooperative transmission schemes 
are described, and their achievable secrecy rate regions are 
derived. A game-theoretic formulation of the problem is 
adopted to allow the transmitters to find an operating point 
that balances network performance and fairness (the so called 
Kalai-Smorodinsky bargaining solution iPTD ). It is shown in 
[ 7 1 1 that, while ordinary jamming is near optimal for the 
standard wiretap channel ll35l . its performance is far from 
optimal for the interference channel. 

V. Relay Channels and Miscellaneous Networks 

A. Relays and Helpers 

The physical layer security in relay networks has drawn 
much attention recently, as a natural extension to the se- 
cure transmission in MIMO networks. The secrecy capacity 
and achievable secrecy rate bounds have been investigated 
for various types of relay-eavesdropper channels, and many 
cooperative strategies, based on the ones that serve for the 
conventional relay systems, have been proposed. 
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Fig. 4. Models of trusted and untrusted relay networks 

As an extreme case study, the relay itself can be considered 
to be an untrusted user, where the relay node acts both as an 
eavesdropper and a helper, i.e., the eavesdropper is co-located 
with the relay node. The source desires to use the relay to 
communicate with the destination, but at the same time intends 
to shield the message from the relay. This group of model 
was first studied in [72| for the general relay channel. Coding 
problems of the relay-wiretap channel are studied under the 
assumption that some of transmitted messages are confidential 
to the relay, and deterministic and stochastic rate regions are 
explicitly derived in Il73l - ll75l . which show that the coopera- 
tion from the untrusted relay is still essential for achieving a 
non-zero secrecy rate. In 11731 , for the general untrusted relay 
channel which can be described as p(Y, Y r \X, X r ) with X, X r 
being the input from the source and the relay, respectively, and 
Y, Y r being the signals received by the relay and destination, 
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respectively, the following achievable region of rate pairs 
(Ri, R e ) is derived: 



u 



R e <Ri< I{X:Y,Y r \X r ) 
0<R e < [I(X;Y,Y r \X r ) - I(X;Y r \X r )Y 



(14) 

Based on this region, the cooperation of an untrusted relay 
node is found to be beneficial for a specific model where there 
is an orthogonal link in the second hop. A more symmetric 
case is discussed in [76|, where both the source and the relay 
send their own private messages while keeping them secret 
from the destination. Assuming a half-duplex amplify-and- 
forward protocol, another effective countermeasure in this case 
is to have the destination jam the relay while it is receiving 
data from the source. This intentional interference can then be 
subtracted out by the destination from the signal it receives 
via the relay. 

However, unlike the aforementioned case, in a trusted relay 
scenario, the eavesdroppers and relays are separate network 
entities. The relays can play various roles with external 
eavesdroppers. They may act purely as traditional relays while 
utilizing help from other nodes to ensure security; they may 
also act as both relaying components as well as cooperative 
jamming partners to enhance the secure transmission; or 
they can assume the role of stand-alone helpers to facilitate 
jamming unintended receivers. 

Helpers serve as friendly jammers that do not have any 
information of their own to transmit, but instead cooperate 
with authorized nodes to degrade the signals intercepted by 
eavesdroppers. For example, from an information-theoretic 
viewpoint, a helper can send a random codeword at a rate that 
ensures that it can be decoded and subtracted from the received 
signal by the intended receiver, but cannot be decoded by the 
eavesdropper. Alternatively, a helper can transmit a jamming 
signal that interferes with the ability of the eavesdropper to 
intercept and decode the desired signal. In both cases, there is 
either no or minimal impact on the mutual information of the 
desired link, but that of the eavesdropper's link is reduced, and 
hence the secrecy rate is improved. For example, in a single- 
antenna wiretap channel with external helpers, an interesting 
approach is to split the transmission time into two phases. 
In the first phase, the transmitter and the intended receiver 
both transmit independent artificial noise signals to the helper 
nodes. The helper nodes and the eavesdropper receive different 
weighted versions of these two signals. In the second stage, the 
helper nodes simply replay a weighted version of the received 
signal, using a publicly available sequence of weights. At the 
same time, the transmitter transmits its secret message, while 
also canceling the artificial noise at the intended receiver |29|. 

A typical model of a relay channel with an external 
eavesdropper is investigated in ||77l . where the four-terminal 
network is introduced and an outer-bound on the optimal rate- 
equivocation region is derived. Specifically, for the traditional 
decode-and-forward (DF) relaying strategy, a achievable per- 



fect secrecy rate is derived as 

R { S DF) = sup [min{/(yi,F 2 ;y|Z7), 

p(u)p{v 1 ,D 2 | U)p(xi ,X2 \V1 ,V 2 ) 

I{Vy,Y x \V 2 ,U)} - I{Vx,V 2 \Y 2 \U)] + (15) 

for some random variables U — > (Vi,V 2 ) — > (Xi,X 2 ) — > 
(Y,Yi,Y 2 ) where Xi,X 2 are the channel inputs from the 
source and the relay respectively, while Y, Y\ , Y 2 are the 
channel outputs at the destination, relay and eavesdropper 
respectively. Lai et al. also propose a noise-forwarding strategy 
where the full-duplex relay sends codewords independent 
with the secrete message to confuse the eavesdropper. In 
[78 1, several cooperative schemes are proposed for a two-hop 
multiple-relay network, and the corresponding relay weights 
are derived aiming to maximize the achievable secrecy rate, 
under the constraint that the link between the source and the 
relay is not protected from eavesdropping. 
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Fig. 5. Two-hop MIMO relay network with external eavesdropper. 

In lISOl . a wiretap channel with an independent helping 
jammer is considered. The interferer can send a random 
codeword at a rate that ensures that it can be decoded and 
subtracted from the received signal by the intended receiver 
but cannot be decoded by the eavesdropper. [81 1 consider 
the cooperative artificial interference approach for MIMO ad 
hoc networks. The model therein can also be regarded as the 
external helper category, since when one pair of nodes are 
communicating with each other, all the nodes surrounding the 
legitimate receiver cooperate to interfere with the eavesdropper 
by sending jamming signals. A general model is given by 



y = H B . x + E- II;,, q, + n B 
z = H B , x + S^ 1 H £; , i q l + n E 



(16) 
(17) 



where Hb o and H^.o are the channels from the source to 
the destination and eavesdropper respectively and H^.; and 
HE,i are the channels from jammer i to the destination and 
eavesdropper respectively, x is the information signals and q; 
is the artificial interference, and y and z are received signals at 
the destination and eavesdropper respectively. For the proposed 
coordinated cooperative jamming scheme in IBTll . orthogonal 
information subspace and jamming subspace are broadcast 
across the network and q; is chosen to lie in the publicized 
jamming subspace such that there will be no interference at 
the destination when an appropriate receive beamformer is 
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used. An uncoordinated cooperative jamming strategy is also 
proposed for the case where the public jamming subspace 
is unavailable. In this case, q; is simply the right singular 
vector of Hba corresponding to the smallest singular value. 
Both schemes have been shown to efficiently increase the 
secrecy capacity, even if the eavesdropper has knowledge of 
the associated subspaces. 

A more general case where cooperative jamming strategies 
guarantee secure communication in both hops using without 
the need for external helpers is studied in [82|. In these 
approaches, the normally inactive node in the relay network 
can be used as cooperative jamming sources to confuse the 
eavesdropper and provide better performance in terms of 
secrecy rate. In the proposed cooperative jamming strategies, 
the source and the destination nodes act as temporary helpers 
to transmit jamming signals during transmission phases in 
which they are normally inactive. We define two types of 
cooperative jamming schemes, full cooperative jamming (FCJ) 
and partial cooperative jamming (PCJ), depending on whether 
or not both the transmitter and the temporary helper transmit 
jamming signals at the same time. 
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In [52], a two-way wiretap channel is considered, in which 
both the source and receiver transmit information over the 
channel to each other in the presence of a wiretapper. Achiev- 
able rates for the two-way Gaussian channel are derived. 
Besides, a cooperative jamming scheme that utilizing the 
potential jammers is shown to be able to further increase 
the secrecy sum rate. [83] shows that using feedback for 
encoding is essential in Gaussian full-duplex two-way wiretap 
channels, while feedback can be ignored in the Gaussian half- 
duplex two-way relay channel with untrusted relays. More 
recently, secure transmission strategies are studied for multi- 
antenna two-way relay channel with network coding with 
the presence of eavesdroppers by [84|-[86|. By applying 
the analog network-coded relaying protocol, the end nodes 
exchange messages in two time slots. In this scenario, the 



eavesdropper has a significant advantage since it obtains two 
observations of the transmitted data compared to a single 
observation at each of the end nodes. As a countermeasure, in 
each of the two communication phases the transmitting nodes 
jam the eavesdropper, either by optimally using any available 
spatial degrees of freedom, or with the aid of external helpers. 

B. Cognitive Radio and Sensor Networks 

As a promising technique to alleviate spectrum scarcity, 
cognitive radio (CR) ll87l is capable of dynamically sensing 
and locating unused spectrum segments in a target spectrum 
pool and communicating using the unused spectrum segments 
in ways that cause no harmful interference to the primary 
users of the spectrum. Due to the vulnerability of physical 
layer spectrum sensing of CR, research attention on physical 
layer security issues, though limited, has emerged recently. 
In jl88l . several classes of physical layer attacks for dynamic 
spectrum access and adaptive radio scenarios are described, 
and corresponding mitigation techniques to these attacks are 
proposed. In [89], the denial-of-service vulnerabilities, from 
the perspectives of the network architecture employed, the 
spectrum access technique used and the spectrum awareness 
model, are examined and possible remedies are provided. 

A so-called primary user emulation threat to spectrum 
sensing is identified in ll90l . and a transmitter verification 
scheme is proposed to verifies whether a given signal is 
that of an incumbent transmitter by estimating its location 
and observing its signal characteristics. In (91], the security 
problem of collaborative sensing for spectrum occupation is 
formulated as 

" ~ '"' p r )("-*-o if/.-- q 

1 if k > q 

(18) 

where Qf and Pf are the overall and individual false alarm 
probabilities respectively. In the sensing network, n users are 
collaboratively reporting sensing results and k of which are 
malicious users who deliver false reports. The base station 
makes the final decision based on certain counting rules related 
to q. The work provides a numerical algorithm to optimize 
q such that Qf is minimized. Thus the issue of improving 
efficiency of spectrum access on a non-interfering basis is 
formulated as a constrained parameter optimization problem, 
which provides a better understanding on the effectiveness of 
the attacks and their countermeasures. 

Wireless sensor networks and corresponding distributed 
estimation algorithms have been at the forefront of signal 
processing research in the past decade. The downlink and 
uplink phases of communication between the sensors and a 
fusion center (FC) are inherently vulnerable to eavesdropping. 
Li, Chen, and Ratazzi [94] tackle downlink secrecy where 
the FC has multiple antennas by deliberately inducing rapid 
time-varying fluctuations in the eavesdropper's channel. ||95ll 
proposed the use of artificial noise-like schemes on the up- 
link to 'confuse' eavesdroppers about the aggregate sensor 
observations sent to the FC. Kundur et al. examine cross- 
layer secrecy-preserving design methodologies for multimedia 
sensor networks in [961. 
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VI. Wireless Secret Key Agreement 

We recall that the original secure communication system 
studied by Shannon was based on secret-key encryption. 
Shannon's result that perfect secrecy required encryption with 
a random one-time pad cipher at least as long as the message 
was widely regarded as a pessimistic result, until it was 
reexamined in the context of noisy channels by Maurer |14|. 
In his seminal work, Maurer decried Wyner's degraded wiretap 
channel as being too unrealistic, and instead proposed a secret- 
key agreement protocol that could be implemented over a 
publicly observable two-way channel in the presence of a 
passive eavesdropper. 

The key elements of Maurer's strategy are the information 
reconciliation and privacy amplification procedures. The infor- 
mation reconciliation phase is aimed at generating an identical 
random sequence between the two terminals by exploiting 
the public discussion channel. The privacy amplification stage 
extracts a secret key from the identical random sequence 
agreed to by two terminals in the preceding information 
reconciliation phase. Less formally, after public discussion 
based on correlated randomness in the first stage, privacy 
amplification reduces a initial piece of random nature into a 
smaller entity (e.g., by linear mapping and universal hashing) 
which is known only by the legitimate users, even if the 
eavesdropper has a less noisy channel in certain cases. 
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Fig. 7. Secret key agreement by public discussion. 

More precisely, it was assumed that the transmitter, receiver 
and adversary have access to repeated independent realizations 
of random variables X, Y, and Z, respectively, with some joint 
probability distribution Px.y.z as in Fig. [7] The eavesdropper 
is completely ignorant of X and Y. The secret-key rate 
S(X;Y\\Z) was then defined as the maximal rate at which 
Alice and Bob can generate a secret key by communication 
over the noiseless and authentic but otherwise insecure channel 
in such a way that the opponent obtains information about this 
key only at an arbitrarily small rate (cf. (O). The following 
upper and lower bounds on the secret key rate were presented: 



S{X;Y\\Z) ^ mm[I(X;Y),I(X;Y\Z)} 



(19) 



S (X; Y\\Z)^ max [I (X; Y) - I (X; Z) ,I(Y;X)-I (Y; Z) 

Closely related results were offered in the concurrent work 
by Ahlswede and Csizar J97j. Csiszar and Narayan studied 
the augmentation of key-based secrecy capacity with the aid 



of a helper which supplies additional correlated information in 
1 98], and obtained a single-letter characterization of the key- 
based secrecy capacities with an arbitrary number of terminals 
in ||99l . Maurer and Wolf subsequently extended the secret- 
key sharing analysis of |[T4l to account for the presence of an 
active eavesdropper in [100]-|102|, and showed that either a 
secret key can be generated at the same rate as in the passive- 
adversary case, or such secret-key agreement is infeasible. 

The next evolution in secret-key sharing was the exploitation 
of the common randomness inherent in reciprocal wireless 
communication channels. Koorapaty et al. relied on the in- 
dependence of the channels between transmitter/receiver and 
transmitter/eavesdropper to use the phase of the fading coef- 
ficients as a secret key 11 1 031 . Other techniques include key 
generation via 

• discretizing extracted coefficients of the multipath com- 
ponents 1104L 

• quantizing the channel phases for a multitone communi- 
cation system such that multiple independent phases are 
used to generate longer keys M105L 

• directly quantizing the complex channel coefficients 
ED, 

• a purposely constructed random variable whose realiza- 
tions are communicated between the legitimate nodes, 
with secrecy achieved when the eavesdropper lacks chan- 
nel state information |107|, 

• exploiting the level crossing rates of the fading processes 
at the legitimate terminals [108], 

• utilizing appropriately timed one-bit feedback available 
in practical networks due to Automatic Repeat reQuest 
(ARQ) protocols fl09l . 

Unsurprisingly, multiple-antenna channels have attracted 
considerable attention for their capabilities of increasing com- 
mon randomness at the legitimate users. Li and Ratazzi 111 1011 
design a MIMO precoder based on knowledge of the main 
channel that renders difficult blind channel estimation by 
the eavesdropper. Chen and Jensen developed practical key 
generation protocols for MIMO systems with temporally and 
spatially correlated channel coefficients in 111 II . Ill 1211 . One 
of the first experimental measurement campaigns on secret 
key generation in reciprocal MIMO channels was presented 
by Wallace and Sharma in 11 13L 

The role of a feedback channel in improving the secrecy 
rate of a wiretap channel has been revisited in recent work. 
In II 141 . the authors show that a noisy feedback channel that 
is observable by all parties can still be utilized to generate 
a secrecy rate equal to the main channel capacity, since the 
feedback from the (either full- or half-duplex) receiver can 
be used to jam the eavesdropper (assuming a modulo-additive 
channel model). Javidi et al. 11 151 consider a secure but rate- 
limited feedback channel, and prove that it is optimal for the 
receiver to feedback a random secret key that is independent 
of its received channel output symbols. 

VII. Related Topics 

A. Code Design for Secrecy 

Once the groundwork had been laid for the limits of 
information-theoretic security, several researchers turned their 
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attention to the development of practical channel codes for 
secrecy. Wyner [9| and Csiszar and Korner |llj had used 
a stochastic coding argument to provide a non-constructive 
proof of the existence of channel codes that guarantee both 
robustness to transmission errors and a prescribed degree of 
data confidentiality as the block length tends to infinity. 

In Wyner's stochastic encoding scheme, a mother codebook 
Co (n) of length n is randomly partitioned into "secret bins" or 
subcodes {Ci(n),C2{n), . . . ,Cm(")}- A message w is asso- 
ciated with a sub-code C w (n) and the transmitted codeword 
is randomly selected within the sub-code. The mother code 
Co(n) provides enough redundancy so that the legitimate re- 
ceiver can decode the message reliably, whereas each sub-code 
is sufficiently large and, hence, introduces enough randomness 
so that the eavesdropper's uncertainty about the transmitted 
message can be guaranteed. However, the development of 
practical wiretap codes for general wiretap channels was not 
as rapid as that of classical error-correction codes, and several 
open problems remain till date. 

Therefore, it was natural to turn to capacity-achieving chan- 
nel codes and examine their applications for secrecy. In [116|, 
Thangaraj et al. advanced the idea of using graph-based codes 
such as low density parity check (LDPC) codes for binary 
erasure wiretap channels (noiseless main channel), and showed 
that both reliability and Wyner's weak secrecy criterion could 
be satisfied simultaneously. Bloch and coauthors [107] adopted 
LDPC codes and multi-level coding for the information rec- 
onciliation phase of a practical secret key agreement protocol. 
For Gaussian wiretap channels, appropriately punctured LDPC 
codes were employed with the relative bit error rate at the 
receiver and eavesdropper as as a proxy security metric in 
111 171 . where the authors showed that a 'security gap' was 
achievable. A turbo code-based scheme with the puncturing 
pattern determined by a pre-shared secret key was presented 
in ||TT8l . 

Graph-based unstructured codes are not the only viable 
approach for wiretap coding. He and Yener [119] show that an 
arbitrarily large secrecy rate is achievable for Gaussian wiretap 
channels with an external helper using structured integer and 
nested lattice codes. Nested lattice codes were also deployed 
over the binary symmetric wiretap channel in 111201 . Arora 
and Sang presented the notion of dialog codes wherein the 
receiver aids the transmitter by jamming the eavesdropper 
while still being able to recover the transmitted symbol [121 J. 
If the receiver is half-duplex, then this can be achieved using 
a rate- 1/2 code with memory where the receiver jams either 
of the code bits but is able to recover the message from the 
remaining bit, whereas the equivocation at the eavesdropper 
is unity. The recently proposed polar coding scheme has been 
shown to achieve the secrecy capacity for binary symmetric 
wiretap channels 111221 . 

While the emerging area of network coding is not directly 
related to traditional channel coding design, we briefly mention 
physical-layer security issues encountered in this field. Net- 
work coding is an paradigm for wireline and wireless networks 
that allows intermediate nodes to mix signals received from 
multiple paths, with the objective of improving throughput. 
Therefore, such networks are vulnerable to eavesdropping, as 



all other networks discussed thus far in this work. 

The secure network coding problem was introduced in [124) 
for multicast wireline networks where each link has equal 
capacity, and a wiretapper can observe an unknown set of up to 
k network links. For this scenario, the secrecy capacity is given 
by the cut set bound and is achieved by injecting k random 
keys at the source which are decoded at the sink along with 
the message II 1 241 . H1251 . Silva and Kschischang II 1261 among 
others have drawn connections between the multicast problem 
and the type-II wiretap channel studied by Ozarow and Wyner, 
as described in Section III-BI Eavesdropping countermeasures 
for wireless network coding systems are described in [84|, 
[127 1, among others. 

B. Cross-Disciplinary Tools 

The interactions between various agents (transmitters, re- 
ceivers, helpers, and attackers) in multiuser wireless networks 
is accurately captured by inter-disciplinary analyses based 
on game theory and microeconomics, and this holds true 
for problems of secrecy as well. Cooperative game theory 
was applied in II 1281 to demonstrate the improvement in 
secrecy capacity of an ad hoc network, when users form 
coalitions to null the signals overheard by eavesdroppers 
via collaborative beamforming. Han et al. Ml 291 developed 
a two-stage Stackelberg game where a transmitter 'pays' a 
number of external helpers to jam an eavesdropper, and com- 
puted the corresponding equilibrium prices and convergence 
properties. The same authors examined a similar scenario in 
111301 . where an auction game was used instead to model the 
transactions between transmitters and helping jammers. Anand 
and Chandramouli studied a M-user non-cooperative power 
control game with secrecy considerations in 111311 . and applied 
pricing functions to improve the energy efficiency and sum 
secrecy capacity of the network. For the 2-user MIMO-IC 
with confidential messages, the so called Kalai-Smorodinsky 
bargaining solution is adopted to allow the transmitters to 
find an operating point that balances network performance and 
fairness lf70l . 

Utilizing secrecy rate as the payoff in a game-theoretic 
formulation is a relatively new concept. Yuksel, Liu, and 
Erkip studied a SISO wiretap network with an adversarial 
jammer helping the eavesdropper as a zero-sum game, and 
presented the Nash Equilibrium input and jammer cumula- 
tive distribution functions 111321 . Mukherjee and Swindlehurst 
posed the MIMO wiretap channel with an active eavesdropper 
as a zero-sum dynamic (sequential) game, and examined the 
equilibrium transmit/wiretapper strategies for games with and 
without perfect information 11331 . 

VIII. CONCLUSION 

This paper provided a comprehensive survey of the field 
of physical-layer security in wireless networks based on 
information-theoretic principles. We commenced with an 
overview of the foundations dating back to Shannon's pioneer- 
ing work on information-theoretic security. We then describe 
the evolution of secure transmission strategies from point- 
to-point channels to multiple-antenna systems, followed by 
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generalizations to multiuser networks. We also evaluate secret- 
key establishment protocols based on physical layer mecha- 
nisms, along with an overview of practical secrecy-preserving 
code design and inter-disciplinary models for security. Several 
recent monographs that provide a more rigorous and in-depth 
introduction to the topic of information-theoretic security are 
|[T34ll-lfT36l. 
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